Data Breach Laws: Do The Dead Deserve Protection?

Data breaches are a serious issue, and it's important to understand how the law treats personal information in the event of an individual's death. In the US, the HIPAA Privacy Rule protects identifiable health information for 50 years following an individual's death, allowing the personal representative of the deceased to exercise rights regarding their health information. After 50 years, the information is no longer considered protected health information, and special disclosure provisions apply. On the other hand, in the UK, GDPR regulations do not apply to personal data relating to deceased individuals, as they only pertain to living individuals. This means that the processing of deceased individuals' data may differ, and businesses must navigate data privacy considerations sensitively. Understanding these legal nuances is crucial for maintaining data privacy and security, especially when dealing with sensitive health information.

In the US, the HIPAA Privacy Rule protects the health information of a decedent for 50 years after their death

In the US, the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule establishes national standards to protect individuals' medical records and other individually identifiable health information. This includes the health information of decedents, which is protected for 50 years following the date of death. This period of protection balances the privacy interests of surviving relatives and others with a relationship to the deceased, with the need for certain professionals to access old records for historical purposes.

During the 50-year protection period, the personal representative of the decedent (i.e., the person with legal authority to act on their behalf) can exercise rights under the Privacy Rule, such as authorising certain uses and disclosures of, and gaining access to, the decedent's health information. The Privacy Rule also permits a covered entity, such as a health plan or healthcare provider, to disclose a decedent's health information to family members or other individuals involved in the decedent's healthcare or payment for care prior to their death, unless this is contrary to the decedent's prior expressed preference.

The Privacy Rule provides special disclosure provisions relevant to deceased individuals, including:

• Alerting law enforcement to a death suspected to have resulted from criminal conduct.
• Disclosing information to coroners, medical examiners, and funeral directors.
• Facilitating organ donation and transplantation.
• Research conducted solely on the protected health information of decedents.

After the 50-year protection period, individually identifiable health information about a decedent is no longer considered protected health information, and can be used or disclosed without regard to the Privacy Rule.

The HIPAA Privacy Rule allows a decedent's personal representative to exercise rights over their health information

The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule protects the health information of a decedent for 50 years following their date of death. This period of protection balances the privacy interests of surviving relatives and other individuals with a relationship to the decedent, with the need for archivists, biographers, historians, and others to access old or ancient records on deceased individuals for historical purposes. During this 50-year period, the decedent's personal representative has the ability to exercise rights under the Privacy Rule with regard to the decedent's health information. This includes the right to authorise certain uses and disclosures of, and gain access to, the information.

The personal representative is the person with authority under applicable law to act on behalf of the decedent or the decedent's estate. This is usually an executor, administrator, or other person who has authority under state or other law to act on behalf of the deceased individual or their estate.

The Privacy Rule gives individuals certain rights with respect to their health information. These include the right to:

• Receive a notice of privacy practices from a health care provider or a health plan that must, among other things, inform patients of the anticipated uses and disclosures of their health information that may be made without the patients' consent or authorization.
• See and obtain a copy of their own health information.
• Request an amendment of information that is incomplete or inaccurate.
• Obtain an accounting of certain disclosures that the covered entity made of their PHI over the past 6 years.

In the UK, GDPR laws do not apply to information relating to deceased people

In the UK, the General Data Protection Regulation (GDPR) laws are designed to protect the privacy and security of personal data. However, it is important to note that these laws specifically apply only to living individuals. This means that in legal terms, GDPR laws do not extend to information relating to deceased people.

This exclusion is explicitly outlined in Recital 27 of the GDPR regulations, which clearly states that "This Regulation [GDPR] does not apply to the personal data of deceased persons. Member States may provide for rules regarding the processing of personal data of deceased persons." This distinction highlights that personal data related to deceased individuals falls outside the scope of GDPR protection.

While GDPR does not cover deceased people, businesses still need to consider data privacy when handling the personal data of the deceased. They must operate with sensitivity and ensure that their databases primarily consist of living individuals. Maintaining accurate and up-to-date data is essential, as failing to remove deceased data can have negative consequences.

Deceased data is highly susceptible to fraud, providing opportunities for identity fraudsters to exploit it for monetary gain. Additionally, communicating with deceased individuals can cause distress to their friends and family, leading to potential brand damage and a negative perception of the organisation. Therefore, it is crucial for businesses to address and remove deceased data from their systems.

Under the Freedom of Information Act 2000, there are no specific exemptions relating to whether a data subject is deceased or not

The Freedom of Information Act 2000 gives the public access to information held by public authorities. This includes government departments, local authorities, the NHS, state schools, and police forces. The Act covers recorded information such as printed documents, computer files, letters, emails, photographs, and sound or video recordings.

While the Act does not give people access to their own personal data, such as health records or credit reference files, individuals can make a data protection subject access request to view information held about them by a public authority.

It is worth noting that the Act only covers public authorities, and individual MPs, assembly members, or councillors are not considered public authorities. Additionally, the Act does not cover information that is solely held on behalf of another person, body, or organisation, including employees' private information, even if stored on work devices or accounts.

Deceased data is susceptible to fraud and identity theft

To prevent identity theft, a surviving spouse or other authorized individuals, such as an executor, can notify the credit bureaus and request that the deceased's files are flagged with a "deceased" notation. This can be done by sending copies of the death certificate to each credit reporting bureau and requesting a "deceased alert" on the credit reports. It is also important to be cautious about the amount of information disclosed in an obituary, as identity thieves can use these details to steal a deceased person's identity.

Additionally, it is the responsibility of the executor of the estate or the deceased's next of kin to ensure that the Social Security Administration is notified of the death as soon as possible. This can be done by calling the Social Security Administration directly or by having a funeral director report the death. Notifying the relevant financial institutions, such as banks and credit card companies, is also crucial to prevent potential fraud.

Taking proactive measures, such as those mentioned above, can help protect the deceased's identity and prevent their data from being misused, reducing potential harm to their loved ones and other involved parties.

Frequently asked questions